Skip to main content
Sign in More Resources

How to configure a Let's Encrypt certificate on a Netsweeper server

Mariam Ghezal
  • Updated

Please note: These steps require root (SSH) access to the server. Let's Encrypt can only issue a certificate for a public, fully qualified domain name (FQDN) that resolves to the server you are configuring, and the server must be reachable from the internet so Let's Encrypt can validate it.

Before you begin

  • Confirm the server's hostname (for example <server.example.com>) has a public DNS A record pointing to the server.
  • Confirm the server is reachable from the internet so the Let's Encrypt validation request can complete.
  • Confirm the server is running Netsweeper on EL8. This article applies to EL8 servers only.
  • Let's Encrypt allows only 5 failed validations per account, per hostname, per hour. Check the items above first to avoid being locked out (see Troubleshooting).

Option 1 - Generate the certificate from the Webadmin

Use this option for a single Webadmin server running Netsweeper 7.2.8 or later on EL8.

Log in to the Webadmin.

Navigate to Administration > Services and select the localhost button to expand the services.

localhost.png

Select the More Actions button for the Webadmin, then select Webadmin SSL Certificate option.

The Webadmin SSL Certificate window allows you to either upload an externally generated certificate to the Webadmin server, or to generate a new one.

Select the option to generate a Let's Encrypt certificate and enter the server's public hostname.

Restarting the Webadmin Service

Once your certificate has been updated, it is necessary to restart the Webadmin Service.

This can either be done from the command line or in the Services window.  

Note: If you find an issue after restarting the services from the Webadmin GUI, restart them from the command line instead.

$ sudo -i systemctl restart webadminctl
$ sudo -i systemctl restart nginx
WebAdminRestart.png

Copying the new Certificate to Remote Servers

If your deployment includes remote servers, such as reporter, deny page or logger servers, do the following on each remote server:

  1. The first time, copy the Webadmin certificate and key to the server, and set the file permissions and ownership to match those on the Webadmin server.
  2. Create the renewal cron job so that the certificate renews automatically.

Verifying the certificate

Open the following addresses. The browser should show a valid, trusted connection with no certificate warning:

  • https://<server.example.com>/ (Webadmin)
  • https://<server.example.com>:3431/ and https://<server.example.com>:3432/ (Policy server)

Option 2 - Generate the certificate from the command line

Use this option for Policy servers, or where the Webadmin option is not available. Replace <server.example.com> with your server's hostname in every command.

Generating and deploying the certificate

  1. Connect to the server over SSH and switch to the root user:

    $ sudo -i

  2. Generate the certificate with a 4096-bit key:

    # /usr/local/netsweeper/bin/manage_certificates.sh letsencrypt_generate 4096 <server.example.com>

  3. Deploy the certificate to the Netsweeper services:

    # /usr/local/netsweeper/bin/acme/acme.sh --deploy -d <server.example.com> --deploy-hook netsweeper

The deploy step installs the certificate and creates /etc/pki/tls/private/localhost.pem for use by HAProxy.

Setting up automatic renewal

  1. Create the renewal cron job:

    # echo "21 0 * * * root /usr/local/netsweeper/bin/acme/acme.sh --cron --home
 /usr/local/netsweeper/bin/acme &> /dev/null" > /etc/cron.d/letsencrypt

  2. Run the renewal once to confirm it works:

    # /usr/local/netsweeper/bin/acme/acme.sh --force --cron --home /usr/local/netsweeper/bin/acme

Important: The file /etc/cron.d/letsencrypt must always exist. Without it, the certificate will not renew and will expire after 90 days.

If your deployment has more than one server, configure the renewal cron job separately on each server.

Verifying the certificate

SSH into the backend Policy servers and run:

[root@proxy1 ~]# cat /etc/cron.d/letsencrypt
49 0 * * * root /usr/local/netsweeper/bin/acme/acme.sh --cron --home /usr/local/netsweeper/bin/acme &> /dev/null
[root@proxy1 ~]# /usr/local/netsweeper/bin/acme/acme.sh --cron --home /usr/local/netsweeper/bin/acme
[Wed Feb 19 08:10:27 EST 2025] ===Starting cron===
[Wed Feb 19 08:10:27 EST 2025] Renew: <server.example.com> 
[Wed Feb 19 08:10:27 EST 2025] Skip, Next renewal time is: 
[Wed Feb 19 08:10:27 EST 2025] Add '--force' to force to renew.
[Wed Feb 19 08:10:27 EST 2025] Skipped <server.example.com> 
[Wed Feb 19 08:10:27 EST 2025] ===End cron===

This output indicates that the renewal cron is running correctly and shows the next renewal time.

 

Additional Information

For information about WebAdmin Certificate Management, please refer to this document

You can find more information about Netsweeper Command Line Tools here.

For further support, please contact your Account Manager to enquire about obtaining professional assistance from our Engineers.